Yin et al. [1]} study the Rademacher complexity of adversarial trained neural networks. Given a feedforward neural network with ReLU activation function, denoted by \(f\) , let \(L\)  be the depth of the network, and \(A_i\)  the parameter matrix of layer \(i\) . The function family represented by \(f\)  with adversarial loss function can be written as
\(\nonumber \mathcal {F} = \lbrace f_A: \min _{x^{\prime }\in \mathbb {B}(\epsilon )} yf_A(x), \prod _{i=1}^L ||A_i||_\sigma \le r\rbrace \) 
